Overview
overview
10Static
static
38863f88750...06.exe
windows7-x64
78863f88750...06.exe
windows10-2004-x64
10$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1azkzkzz.exe
windows7-x64
1azkzkzz.exe
windows10-2004-x64
10d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...dex.js
windows7-x64
1resources/...dex.js
windows10-2004-x64
1resources/....2.bat
windows7-x64
7resources/....2.bat
windows10-2004-x64
7resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Resubmissions
23/03/2024, 20:50
240323-zmtl5aeg7z1023/03/2024, 01:09
240323-bh4drsbd561022/03/2024, 21:56
240322-1tr8baca3v1022/03/2024, 02:58
240322-dglhnsff4910Analysis
- max time kernel
171s - max time network
184s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
22/03/2024, 02:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
azkzkzz.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
azkzkzz.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
vk_swiftshader.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
vulkan-1.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
vulkan-1.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240319-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 8.7MB
- Sample240322-dglhnsff49
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3156 msedge.exe 3156 msedge.exe 4496 msedge.exe 4496 msedge.exe 4604 identity_helper.exe 4604 identity_helper.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe 4932 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe 4496 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4496 wrote to memory of 1484 4496 msedge.exe 87 PID 4496 wrote to memory of 1484 4496 msedge.exe 87 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 4324 4496 msedge.exe 89 PID 4496 wrote to memory of 3156 4496 msedge.exe 90 PID 4496 wrote to memory of 3156 4496 msedge.exe 90 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91 PID 4496 wrote to memory of 1052 4496 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff8421f46f8,0x7ff8421f4708,0x7ff8421f47182⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:1808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:82⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:12⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:1044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:12⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:12⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5459744810262662502,14014404693820080842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4680 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2488
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
- MD5 36bb45cb1262fcfcab1e3e7960784eaa
- SHA1 ab0e15841b027632c9e1b0a47d3dec42162fc637
- SHA512 02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
- MD5 1e3dc6a82a2cb341f7c9feeaf53f466f
- SHA1 915decb72e1f86e14114f14ac9bfd9ba198fdfce
- SHA512 0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 59faba87a0b5794f2d81618b7ff92e192d18096662ba2cb286b3d4cc2efae2e0
- MD5 9880d90e55fb080bc03013a31bc7c1d6
- SHA1 1d87dbbd13f4b02d22f2564acfb570a2c639fef8
- SHA512 c88c1f2333705b799cff9055929ff8904423b9d56540154cfb51afb66dc983ddbf6af4b6f67f946deb62f4c8920b3f8a746136eeaaf041bb5cbb0b40852e664d
- SSDEEP 96:n6BknKYQY1UBsV8wpvWMoiVmdeHCurFs+UWQyV+VD7ziEwb:n6BkKKSBsV8GWMXlFs+rt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 64fb93fa25d83088355af1ab04be5c32571e5172e024605ffbb7e8684ec8626d
- MD5 8404e5bd1a8e76a69733858cf9fa0504
- SHA1 76ab5c1e707279364b962090953d8ef3560b8ffe
- SHA512 0320a75ae7e600e743bd7aea82a30a7c15210e96d01e9c76447730b8fd886887f79fc39a55f755b1f271d846ca188904eda8fedd9d59b407e068f94341645d08
- SSDEEP 96:n6Bk+KYQY1UBsV8wpvWMoiVmdeHCurFs+UWQyV+VD7AiEwb:n6BkXKSBsV8GWMXlFs+rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 3d35f8da553ccff570b0ecfb1c087e199c7cf7c6a772411383bdf27fed76ba7f
- MD5 705154f093a269f407cdc836ef1eb949
- SHA1 a4c4380bdfba2c9bc5df56350293f1ad279c47f4
- SHA512 8b9c002909420140e67ac7d6a2d700baab1bf718fc01e8a901315ed625f9314efdb626df154987f0a04972a37519129b29370a7d2c228e5b96e7be89702551cc
- SSDEEP 96:n6Bk+KYQY1UxsV8wpvWMoiVmdeHCurFs+UWQyV+VD7AiEwb:n6BkXKSxsV8GWMXlFs+rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 c11d02cde7c39243a08be89152699455e6678ec62b7319cc77e2a297759e45fe
- MD5 ba3d5d3b8287c2c8b7187e22b93521f6
- SHA1 1f480be118bf3374f3de1401d38baa068a0edf4f
- SHA512 cc716cd8f2129d4d09192f7fff8ef35c3b4c365c2fd5915d3d9c1b43bc423721f527ca59fc5a1b0598babb5f4bd6db8d70d9c47d8b2ac5201d6d2e958539f5ff
- SSDEEP 192:ioCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5X7e2RUMd7NvbqrfIQJUmY:29iIxuERzA83h09RZxY5Xrpdh+rfIeET
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 2d021b0ec30bb3180ca1d03e946d6b37fda413c327ee9b71182705777a77fe6b
- MD5 49cf95f2e19ea9f542f62a4f9bd7110d
- SHA1 01d7f3f969149078182b13ee6b6e7869de0ba667
- SHA512 b76c25258fd1377c02578d4ac88055266ad3c3c4bfa63b42008c4b7c5fb818701f397e251dd7eedb062cb485a586c514a22bb41bb092dcd74e785a9279233333
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTXX7e2RUMd7NvbqrYIQJUp:A9iIxuERzA83h09RZxYTXXrpdh+rYIeY
- MD5 SHA1 SHA512 SSDEEP